Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-12-2024 20:55
Static task
static1
Behavioral task
behavioral1
Sample
V1.7.1-Fixed.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
V1.7.1-Fixed.exe
Resource
win10v2004-20241007-en
General
-
Target
V1.7.1-Fixed.exe
-
Size
385.3MB
-
MD5
2a8232328ce1284a136daed4eef7aa9f
-
SHA1
7fff50776487cc4b04a56d229f00cdf9dd81c32a
-
SHA256
1d0c2aa2a51d30c38f461d7af3709c14ff9c5e009509733c453233b5d243eb8e
-
SHA512
651d80097d01074875c69dddd396108348306799cdae4ce63a15c985cad051a617ea102fca07c25cff71feaf13deebfe62d6dfc89666c574df6746bff89e2614
-
SSDEEP
12582912:XZy50LHPZAtgAzt//N0vsqNbCFxocf5HIdE:XZdLvZAzlAxmD1Iu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2840 Exela.exe 1520 Exela.exe 1856 Exela.exe 864 Exela.exe 1868 Exela.exe 1656 Exela.exe 2192 Exela.exe 2452 Exela.exe 3032 Exela.exe 1564 Exela.exe 2512 Exela.exe 604 Exela.exe 2984 Exela.exe 2936 Exela.exe 2588 Exela.exe 2284 Exela.exe 340 Exela.exe 1144 Exela.exe 1612 Exela.exe 2352 Exela.exe 2324 Exela.exe 1584 Exela.exe 2860 Exela.exe 672 Exela.exe 2804 Exela.exe 1636 Exela.exe 944 Exela.exe 316 Exela.exe 1320 Exela.exe 1960 Exela.exe 2024 Exela.exe 2412 Exela.exe 1588 Exela.exe 2152 Exela.exe 2712 Exela.exe 1052 Exela.exe 1064 Exela.exe 648 Exela.exe 1204 Exela.exe 1884 Exela.exe 1744 Exela.exe 2172 Exela.exe 2972 Exela.exe 2920 Exela.exe 1356 Exela.exe 2276 Exela.exe 2716 Exela.exe 776 Exela.exe 1680 Exela.exe 2460 Exela.exe 1596 Exela.exe 1560 Exela.exe 2608 Exela.exe 624 Exela.exe 2304 Exela.exe 1212 Exela.exe 2520 Exela.exe 1920 Exela.exe 1696 Exela.exe 2992 Exela.exe 2168 Exela.exe 612 Exela.exe 3056 Exela.exe 2672 Exela.exe -
Loads dropped DLL 64 IoCs
pid Process 2692 V1.7.1-Fixed.exe 2840 Exela.exe 1520 Exela.exe 1520 Exela.exe 1520 Exela.exe 1520 Exela.exe 1520 Exela.exe 1520 Exela.exe 1520 Exela.exe 1744 V1.7.1-Fixed.exe 1856 Exela.exe 864 Exela.exe 864 Exela.exe 864 Exela.exe 864 Exela.exe 864 Exela.exe 864 Exela.exe 864 Exela.exe 2016 V1.7.1-Fixed.exe 1868 Exela.exe 1656 Exela.exe 1656 Exela.exe 1656 Exela.exe 1656 Exela.exe 1656 Exela.exe 1656 Exela.exe 1656 Exela.exe 1416 V1.7.1-Fixed.exe 2192 Exela.exe 2452 Exela.exe 2452 Exela.exe 2452 Exela.exe 2452 Exela.exe 2452 Exela.exe 2452 Exela.exe 2452 Exela.exe 2904 V1.7.1-Fixed.exe 3032 Exela.exe 1564 Exela.exe 1564 Exela.exe 1564 Exela.exe 1564 Exela.exe 1564 Exela.exe 1564 Exela.exe 1564 Exela.exe 2992 V1.7.1-Fixed.exe 2512 Exela.exe 604 Exela.exe 604 Exela.exe 604 Exela.exe 604 Exela.exe 604 Exela.exe 604 Exela.exe 604 Exela.exe 760 V1.7.1-Fixed.exe 2984 Exela.exe 2936 Exela.exe 2936 Exela.exe 2936 Exela.exe 2936 Exela.exe 2936 Exela.exe 2936 Exela.exe 2936 Exela.exe 2908 V1.7.1-Fixed.exe -
resource yara_rule behavioral1/files/0x000500000001c890-105.dat upx behavioral1/memory/1520-107-0x000007FEF5EB0000-0x000007FEF6316000-memory.dmp upx behavioral1/memory/864-211-0x000007FEF5A40000-0x000007FEF5EA6000-memory.dmp upx behavioral1/memory/1656-315-0x000007FEF55D0000-0x000007FEF5A36000-memory.dmp upx behavioral1/memory/2452-410-0x000007FEF5160000-0x000007FEF55C6000-memory.dmp upx behavioral1/files/0x000400000001db1a-427.dat upx behavioral1/files/0x000400000001db10-426.dat upx behavioral1/files/0x000400000001dba9-429.dat upx behavioral1/files/0x000400000001db1e-428.dat upx behavioral1/files/0x000400000001db07-424.dat upx behavioral1/files/0x000400000001db05-423.dat upx behavioral1/files/0x000400000001db03-422.dat upx behavioral1/files/0x000400000001db01-421.dat upx behavioral1/files/0x000400000001daff-420.dat upx behavioral1/files/0x000400000001dafd-419.dat upx behavioral1/files/0x000400000001dafb-418.dat upx behavioral1/files/0x000400000001dd0b-486.dat upx behavioral1/files/0x000400000001dd01-485.dat upx behavioral1/files/0x000400000001dcf3-484.dat upx behavioral1/files/0x000400000001dd35-491.dat upx behavioral1/files/0x000400000001dd31-490.dat upx behavioral1/files/0x000400000001dd59-495.dat upx behavioral1/files/0x000400000001dd52-494.dat upx behavioral1/files/0x000400000001dd41-493.dat upx behavioral1/files/0x000400000001dd11-487.dat upx behavioral1/files/0x000400000001dce9-483.dat upx behavioral1/files/0x000400000001dce1-482.dat upx behavioral1/files/0x000400000001dcc8-481.dat upx behavioral1/files/0x000400000001daf9-417.dat upx behavioral1/files/0x000400000001daf7-416.dat upx behavioral1/files/0x000400000001daf5-415.dat upx behavioral1/files/0x000400000001daf3-414.dat upx behavioral1/files/0x000400000001daef-413.dat upx behavioral1/files/0x000400000001daea-412.dat upx behavioral1/memory/1564-496-0x000007FEF4BF0000-0x000007FEF5056000-memory.dmp upx behavioral1/memory/604-582-0x000007FEF4680000-0x000007FEF4AE6000-memory.dmp upx behavioral1/memory/2936-668-0x000007FEF40F0000-0x000007FEF4556000-memory.dmp upx behavioral1/memory/2284-755-0x000007FEF3B30000-0x000007FEF3F96000-memory.dmp upx behavioral1/memory/1144-842-0x000007FEF3570000-0x000007FEF39D6000-memory.dmp upx behavioral1/memory/2352-928-0x000007FEF2BA0000-0x000007FEF3006000-memory.dmp upx behavioral1/memory/1584-931-0x000007FEF2730000-0x000007FEF2B96000-memory.dmp upx behavioral1/memory/672-1017-0x000007FEF22C0000-0x000007FEF2726000-memory.dmp upx behavioral1/memory/1636-1104-0x000007FEF1E50000-0x000007FEF22B6000-memory.dmp upx behavioral1/memory/316-1191-0x000007FEEE930000-0x000007FEEED96000-memory.dmp upx behavioral1/memory/1960-1278-0x000007FEEE4C0000-0x000007FEEE926000-memory.dmp upx behavioral1/memory/2412-1366-0x000007FEEE050000-0x000007FEEE4B6000-memory.dmp upx behavioral1/memory/2152-1454-0x000007FEEDBE0000-0x000007FEEE046000-memory.dmp upx behavioral1/memory/1052-1541-0x000007FEED770000-0x000007FEEDBD6000-memory.dmp upx behavioral1/memory/648-1629-0x000007FEED300000-0x000007FEED766000-memory.dmp upx behavioral1/memory/1884-1717-0x000007FEECD90000-0x000007FEED1F6000-memory.dmp upx behavioral1/memory/2172-1804-0x000007FEEC820000-0x000007FEECC86000-memory.dmp upx behavioral1/memory/2920-1892-0x000007FEEC2A0000-0x000007FEEC706000-memory.dmp upx -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x0008000000012102-2.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language V1.7.1-Fixed.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2840 2692 V1.7.1-Fixed.exe 30 PID 2692 wrote to memory of 2840 2692 V1.7.1-Fixed.exe 30 PID 2692 wrote to memory of 2840 2692 V1.7.1-Fixed.exe 30 PID 2692 wrote to memory of 2840 2692 V1.7.1-Fixed.exe 30 PID 2840 wrote to memory of 1520 2840 Exela.exe 31 PID 2840 wrote to memory of 1520 2840 Exela.exe 31 PID 2840 wrote to memory of 1520 2840 Exela.exe 31 PID 2692 wrote to memory of 1744 2692 V1.7.1-Fixed.exe 32 PID 2692 wrote to memory of 1744 2692 V1.7.1-Fixed.exe 32 PID 2692 wrote to memory of 1744 2692 V1.7.1-Fixed.exe 32 PID 2692 wrote to memory of 1744 2692 V1.7.1-Fixed.exe 32 PID 1744 wrote to memory of 1856 1744 V1.7.1-Fixed.exe 33 PID 1744 wrote to memory of 1856 1744 V1.7.1-Fixed.exe 33 PID 1744 wrote to memory of 1856 1744 V1.7.1-Fixed.exe 33 PID 1744 wrote to memory of 1856 1744 V1.7.1-Fixed.exe 33 PID 1856 wrote to memory of 864 1856 Exela.exe 34 PID 1856 wrote to memory of 864 1856 Exela.exe 34 PID 1856 wrote to memory of 864 1856 Exela.exe 34 PID 1744 wrote to memory of 2016 1744 V1.7.1-Fixed.exe 35 PID 1744 wrote to memory of 2016 1744 V1.7.1-Fixed.exe 35 PID 1744 wrote to memory of 2016 1744 V1.7.1-Fixed.exe 35 PID 1744 wrote to memory of 2016 1744 V1.7.1-Fixed.exe 35 PID 2016 wrote to memory of 1868 2016 V1.7.1-Fixed.exe 36 PID 2016 wrote to memory of 1868 2016 V1.7.1-Fixed.exe 36 PID 2016 wrote to memory of 1868 2016 V1.7.1-Fixed.exe 36 PID 2016 wrote to memory of 1868 2016 V1.7.1-Fixed.exe 36 PID 1868 wrote to memory of 1656 1868 Exela.exe 37 PID 1868 wrote to memory of 1656 1868 Exela.exe 37 PID 1868 wrote to memory of 1656 1868 Exela.exe 37 PID 2016 wrote to memory of 1416 2016 V1.7.1-Fixed.exe 38 PID 2016 wrote to memory of 1416 2016 V1.7.1-Fixed.exe 38 PID 2016 wrote to memory of 1416 2016 V1.7.1-Fixed.exe 38 PID 2016 wrote to memory of 1416 2016 V1.7.1-Fixed.exe 38 PID 1416 wrote to memory of 2192 1416 V1.7.1-Fixed.exe 39 PID 1416 wrote to memory of 2192 1416 V1.7.1-Fixed.exe 39 PID 1416 wrote to memory of 2192 1416 V1.7.1-Fixed.exe 39 PID 1416 wrote to memory of 2192 1416 V1.7.1-Fixed.exe 39 PID 2192 wrote to memory of 2452 2192 Exela.exe 40 PID 2192 wrote to memory of 2452 2192 Exela.exe 40 PID 2192 wrote to memory of 2452 2192 Exela.exe 40 PID 1416 wrote to memory of 2904 1416 V1.7.1-Fixed.exe 41 PID 1416 wrote to memory of 2904 1416 V1.7.1-Fixed.exe 41 PID 1416 wrote to memory of 2904 1416 V1.7.1-Fixed.exe 41 PID 1416 wrote to memory of 2904 1416 V1.7.1-Fixed.exe 41 PID 2904 wrote to memory of 3032 2904 V1.7.1-Fixed.exe 42 PID 2904 wrote to memory of 3032 2904 V1.7.1-Fixed.exe 42 PID 2904 wrote to memory of 3032 2904 V1.7.1-Fixed.exe 42 PID 2904 wrote to memory of 3032 2904 V1.7.1-Fixed.exe 42 PID 3032 wrote to memory of 1564 3032 Exela.exe 43 PID 3032 wrote to memory of 1564 3032 Exela.exe 43 PID 3032 wrote to memory of 1564 3032 Exela.exe 43 PID 2904 wrote to memory of 2992 2904 V1.7.1-Fixed.exe 44 PID 2904 wrote to memory of 2992 2904 V1.7.1-Fixed.exe 44 PID 2904 wrote to memory of 2992 2904 V1.7.1-Fixed.exe 44 PID 2904 wrote to memory of 2992 2904 V1.7.1-Fixed.exe 44 PID 2992 wrote to memory of 2512 2992 V1.7.1-Fixed.exe 45 PID 2992 wrote to memory of 2512 2992 V1.7.1-Fixed.exe 45 PID 2992 wrote to memory of 2512 2992 V1.7.1-Fixed.exe 45 PID 2992 wrote to memory of 2512 2992 V1.7.1-Fixed.exe 45 PID 2512 wrote to memory of 604 2512 Exela.exe 46 PID 2512 wrote to memory of 604 2512 Exela.exe 46 PID 2512 wrote to memory of 604 2512 Exela.exe 46 PID 2992 wrote to memory of 760 2992 V1.7.1-Fixed.exe 47 PID 2992 wrote to memory of 760 2992 V1.7.1-Fixed.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"7⤵
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"9⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"10⤵
- Executes dropped EXE
PID:2284
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"9⤵
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"10⤵
- Executes dropped EXE
PID:340 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"11⤵
- Executes dropped EXE
PID:1144
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"10⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"11⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"12⤵
- Executes dropped EXE
PID:2352
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"11⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"12⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"13⤵
- Executes dropped EXE
PID:1584
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"12⤵
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"13⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"14⤵
- Executes dropped EXE
PID:672
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"13⤵
- System Location Discovery: System Language Discovery
PID:300 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"14⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"15⤵
- Executes dropped EXE
PID:1636
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"14⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"15⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"16⤵
- Executes dropped EXE
PID:316
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"15⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"16⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"17⤵
- Executes dropped EXE
PID:1960
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"16⤵
- System Location Discovery: System Language Discovery
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"17⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"18⤵
- Executes dropped EXE
PID:2412
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"17⤵
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"18⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"19⤵
- Executes dropped EXE
PID:2152
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"18⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"19⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"20⤵
- Executes dropped EXE
PID:1052
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"19⤵
- System Location Discovery: System Language Discovery
PID:112 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"20⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"21⤵
- Executes dropped EXE
PID:648
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"20⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"21⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"22⤵
- Executes dropped EXE
PID:1884
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"21⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"22⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"23⤵
- Executes dropped EXE
PID:2172
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"22⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"23⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"24⤵
- Executes dropped EXE
PID:2920
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"23⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"24⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"25⤵
- Executes dropped EXE
PID:2276
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"24⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"25⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"26⤵
- Executes dropped EXE
PID:776
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"25⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"26⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"27⤵
- Executes dropped EXE
PID:2460
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"26⤵
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"27⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"28⤵
- Executes dropped EXE
PID:1560
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"27⤵
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"28⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"29⤵
- Executes dropped EXE
PID:624
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"28⤵
- System Location Discovery: System Language Discovery
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"29⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"30⤵
- Executes dropped EXE
PID:1212
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"29⤵
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"30⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"31⤵
- Executes dropped EXE
PID:1920
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"30⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"31⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"32⤵
- Executes dropped EXE
PID:2992
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"31⤵
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"32⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"33⤵
- Executes dropped EXE
PID:612
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"32⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"33⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"34⤵
- Executes dropped EXE
PID:2672
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"33⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"34⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"35⤵PID:2800
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"34⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"35⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"36⤵PID:1452
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"35⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"36⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"37⤵PID:2736
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"36⤵
- System Location Discovery: System Language Discovery
PID:808 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"37⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"38⤵PID:2792
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"37⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"38⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"39⤵PID:2100
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"38⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"39⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"40⤵PID:1092
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"39⤵
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"40⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"41⤵PID:2940
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"40⤵
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"41⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"42⤵PID:700
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"41⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"42⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"43⤵PID:1484
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"42⤵
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"43⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"44⤵PID:2780
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"43⤵
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"44⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"45⤵PID:2480
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"44⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"45⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"46⤵PID:328
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"45⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"46⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"47⤵PID:1576
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"46⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"47⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"48⤵PID:2420
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"47⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"48⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"49⤵PID:320
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"48⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"49⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"50⤵PID:3036
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"49⤵
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"50⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"51⤵PID:2044
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"50⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"51⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"52⤵PID:2140
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"51⤵
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"52⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"53⤵PID:2080
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"52⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"53⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"54⤵PID:1528
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"53⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"54⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"55⤵PID:1000
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"54⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"55⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"56⤵PID:3240
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"55⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"56⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"57⤵PID:3636
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"56⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"57⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"58⤵PID:4036
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"57⤵
- System Location Discovery: System Language Discovery
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"58⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"59⤵PID:2468
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"58⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"59⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"60⤵PID:3620
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"59⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"60⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"61⤵PID:3080
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"60⤵
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"61⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"62⤵PID:3372
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"61⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"62⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"63⤵PID:3868
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"62⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"63⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"64⤵PID:3084
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"63⤵
- System Location Discovery: System Language Discovery
PID:900 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"64⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"65⤵PID:3536
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"64⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"65⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"66⤵PID:4024
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"65⤵
- System Location Discovery: System Language Discovery
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"66⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"67⤵PID:4076
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"66⤵
- System Location Discovery: System Language Discovery
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"67⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"68⤵PID:1124
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"67⤵
- System Location Discovery: System Language Discovery
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"68⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"69⤵PID:3708
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"68⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"69⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"70⤵PID:3464
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"69⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"70⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"71⤵PID:3292
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"70⤵
- System Location Discovery: System Language Discovery
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"71⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"72⤵PID:3216
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"71⤵
- System Location Discovery: System Language Discovery
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"72⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"73⤵PID:3560
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"72⤵
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"73⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"74⤵PID:3428
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"73⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"74⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"75⤵PID:3660
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"74⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"75⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"76⤵PID:1604
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"75⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"76⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"77⤵PID:3608
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"76⤵
- System Location Discovery: System Language Discovery
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"77⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"78⤵PID:3544
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"77⤵
- System Location Discovery: System Language Discovery
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"78⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"79⤵PID:3704
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"78⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"79⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"80⤵PID:4064
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"79⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"80⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"81⤵PID:3504
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"80⤵
- System Location Discovery: System Language Discovery
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"81⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"82⤵PID:3628
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"81⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"82⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"83⤵PID:3600
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"82⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"83⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"84⤵PID:2464
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"83⤵
- System Location Discovery: System Language Discovery
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"84⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"85⤵PID:2868
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"84⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"85⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"86⤵PID:3632
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"85⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"86⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"87⤵PID:3904
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"86⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"87⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"88⤵PID:3756
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"87⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"88⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"89⤵PID:3832
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"88⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"89⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"90⤵PID:760
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"89⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"90⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"91⤵PID:2664
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"90⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"91⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"92⤵PID:3396
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"91⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"92⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"93⤵PID:3480
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"92⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"93⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"94⤵PID:4168
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"93⤵
- System Location Discovery: System Language Discovery
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"94⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"95⤵PID:4568
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"94⤵
- System Location Discovery: System Language Discovery
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"95⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"96⤵PID:4968
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"95⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"96⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"97⤵PID:3548
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"96⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"97⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"98⤵PID:4496
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"97⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"98⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"99⤵PID:4932
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"98⤵
- System Location Discovery: System Language Discovery
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"99⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"100⤵PID:4100
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"99⤵
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"100⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"101⤵PID:4468
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"100⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"101⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"102⤵PID:4916
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"101⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"102⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"103⤵PID:4964
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"102⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"103⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"104⤵PID:4220
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"103⤵
- System Location Discovery: System Language Discovery
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"104⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"105⤵PID:4132
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"104⤵
- System Location Discovery: System Language Discovery
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"105⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"106⤵PID:4348
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"105⤵
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"106⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"107⤵PID:4676
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"106⤵
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"107⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"108⤵PID:932
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"107⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"108⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"109⤵PID:4012
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"108⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"109⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"110⤵PID:3768
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"109⤵
- System Location Discovery: System Language Discovery
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"110⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"111⤵PID:3108
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"110⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"111⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"112⤵PID:4728
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"111⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"112⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"113⤵PID:3800
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"112⤵
- System Location Discovery: System Language Discovery
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"113⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"114⤵PID:4628
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"113⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"114⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"115⤵PID:3564
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"114⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"115⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"116⤵PID:3616
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"115⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"116⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"117⤵PID:2356
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"116⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"117⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"118⤵PID:1140
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"117⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"118⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"119⤵PID:1268
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"118⤵
- System Location Discovery: System Language Discovery
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"119⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"120⤵PID:2092
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"119⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"120⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"121⤵PID:4848
-
-
-
C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"C:\Users\Admin\AppData\Local\Temp\V1.7.1-Fixed.exe"120⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"121⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"122⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-